# CVE-2025-47423: Personal Weather Station Dashboard - Path Traversal

> Live exploitation tracking for CVE-2025-47423 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-47423

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 5.8
- **Public exploit available:** Yes
- **Affected products:** Pwsdashboard Personal Weather Station Dashboard
- **Weaknesses:** CWE-24 (Path Traversal: '../filedir')
- **Tags:** web_application

## Description

Personal Weather Station Dashboard 12_lts allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in the test parameter to /others/_test.php, as demonstrated by reading the server's private SSL key in cleartext.

## CrowdSec analysis

[CVE-2025-47423](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-47423) is a path traversal vulnerability in Personal Weather Station Dashboard 12_lts that allows unauthenticated remote attackers to read arbitrary files on the server by exploiting the test parameter in /others/_test.php. This flaw could be leveraged to access sensitive files, such as the server's private SSL key, potentially leading to further compromise of the system's security.

CrowdSec has been tracking this vulnerability and its exploits since 21st of January 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-47423 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the `/others/_test.php` endpoint by supplying directory traversal sequences (e.g., `../`) in the `test` parameter to access sensitive files such as private SSL keys.

## Timeline

- 2025-05-07: CVE Published. CVE-2025-47423 is published to NVD.
- 2026-01-21: Rule Released. CrowdSec releases a rule to detect CVE-2025-47423 exploitation attempts against the CrowdSec Network.
- 2026-05-21: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-47423 for the first time.

## References

- https://github.com/haluka92/CVE-2025-47423
- https://pwsdashboard.com/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-47423.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-47423) follows observed exploitation activity for CVE-2025-47423. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.